Using a custom CA in SSL for Nodejs applications

[Ferk]

There's not much documentation about socket.io with SSL. And I couldn't find any option concerning trusted Certificate Authorities.

How can I specify the list of certificate authorities that are trusted when I create a socket from nodejs?

I need to use a custom CA for my nodejs application and I want that only authorized certificates are allowed, the ones coming from my root certificate.

I even acked through the code trying to find anything that might help me, but there's nothing, the only option that can be provided when connecting from the client is the "secure" flag, which mostly just takes care to set the right protocol string in the url in a bunch of places and to set the default port to either 443 or 80.

I assume that this feature is not implemented? where does socket.io-client obtain the list of trusted Certificate Authorities? or if it doesn't, then at which point does it delegate this job to a different layer?

[rauchg]

Like I said on the socket.io issue, the best way to approach this would be to allow passing any request related option to the client (for usage from node.js), including the CA options of course.

[Ferk]

Oh, I see. Thanks.

Is there perhaps a way for the socket.io-client to connect using an already existing "tls" object, in a similar way to how the socket.io server can do?

var app = require('tls').createServer(options);
io = require("socket.io").listen(app);

Would it make sense to do something like this for the client too, or am I talking nonsense?

Is there a hack for me to do it currently or would I be better off switching to bare tls?

[rauchg]

I think there's a trick you can do by changing the settings of the globalAgent

[FruitieX]

Hey, any updates on this issue now that Socket.IO 1.0 is out?

In my Node.js application I also need Socket.IO-client to accept a custom CA. I tried changing settings of the globalAgent but it seems Socket.IO-client does not use these!

As a side note, my application works when running node with the NODE_TLS_REJECT_UNAUTHORIZED=0 environment variable set, but to my understanding this leaves the application vulnerable to man-in-the middle attacks.

[zxc23]

Is this still not possible?